Whois Record Falsification Closer To Illegality

PipianJ writes "Reuters is reporting that the House of Representatives has recently passed the bill that would approve of penalties for those using fraudulent WHOIS records (H.R. 3632). Interestingly however, this does not directly outlaw it, instead extending the penalty by seven years for felonies performed using such fraudulent websites. The Senate has not yet passed their version (S.2242). The bill as originally written, however, focuses primarily on penalties for promoting counterfeit music, computer programs, and other media with identical labeling."

Comments

Re:What about those concerned with privacy?

[Kenja]

Jebus. People aren't even reading the summery, much less the article. Here, let me refresh your memory.

Interestingly however, this does not directly outlaw it, instead extending the penalty by seven years for felonies performed using such fraudulent websites.

So when you use false information to avoid SPAM or protect your privacy are you committing fraud?

Then use DomainsByProxy.com

[mr_rangr]

I register my domains at GoDaddy.com, and use DBP for my WHOIS information. I rarely get any spam coming through my mydomain.com@domainsbyproxy.com address.
At least with this legislative leniency, my approach won't be outlawed yet.

The linked-to bill is scarier than the real one

[0x0d0a]

The Federal Anticounterfeiting Act of 2004, the bill that was *actually* linked to, is some scary stuff.

Writing a program like Daemon Tools (no, not the *IX suite of software, the CD image software) or bnetd (a FOSS Battle.net implementation) would become illegal, with a potential five year federal prison penalty.

Why have I not heard about this before?

Re:The linked-to bill is scarier than the real one

[0x0d0a]

Well, up to five years, not a guaranteed five years. 3.a.2.B lists the "illicit authentication feature" that I'm referring to, and 3.a.3 lists the five year prison penalty.

3.6.A has a definition of what an illicit authentication feature is.

Re:It's going to be interesting...

[Jameth]

I do disagree. I don't think this will be used too much in raids, but I do think that it will be tacked onto the tail-end of countless lists of offenses that criminals are charged with, allowing the prosecutors to easily add a few years to the sentence.

Enforcement

[yintercept]

watching them try to enforce it.

Sounds more like this effort is about increasing criminal penalties to people who use the fraudulent information in their registry for scams than it is about forcing everyone to give their cell phone and primary email account in their registration.

For example, imagine a company that uses the address for a local bank in their program to harvest credit card numbers from web surfers. If caught the whois records add to the fraud case.

If this is the intention of the legislation, then enforcement is not a major issue...since it is something tacked onto other scams.

I thought this already was...

[Chuck Bucket]

I thought this was illegal, I rem filling out something with some legal stuff when I signed up for my domains, and I was bummed that I would have to put my personal details out there. Then I found Domains by proxy and I didn't have to. So, I didn't break the law, but you can't find my name/address/email with a simple whois!

CB

Re:What about those concerned with privacy?

[tukkayoot]

The economy? Give me a break, most spam isn't even taxed (since it's illegal). And I don't think spammers have a powerful Washington lobby, yet, anyway.

You really think politicians really care about protecting the economic interests of a bunch of criminals who can't/won't even help them get reelected?

And, IANAL, but I don't think providing false information is always considered fraud from a legal stand point. It's legal to use a pseudonym, ect. under certain circumstances.

Re:Hide your info with...

[.com b4 .storm]

Yeah, except if someone sends a letter (even if it's bogus) to your domainsbyproxy.com address, they'll charge $20 just for telling you it arrived and where it's from. Then, if you want to actually READ the mail, you have to pay even more to have it actually forwarded or read through by a human being. Think hourly lawyer fees, because that's basically what you get with this service. If somebody sneezes in the general direction of your domain, some desk clerk will press a button and charge your credit card for it.

I had a domain through domainsbyproxy.com, and I ended up receiving a letter accusing me of infringing on a trademark (one that is easily proven to be common and in prior use via Google or Usenet archives, and even previous to the birth of the internet). I turned over the domain because I'm just a student who lacks the resources to challenge a trademark, no matter how obviously invalid, especially for a novelty domain. But I ended up eating that bogus $20 "you've got mail" cost. It's all in the domainsbyproxy.com contract of course, but it's definitely got its drawbacks that a lot of people might not be aware of.

Re:i investigated it a little bit

[bigtangringo]

This is the same type of law that is currently in place (in many states) for things such as body armor and lock picks. It is perfectly legal to have these things, but if you use them in a crime the penalty is much worse.

Re:i investigated it a little bit

[Anonymous Coward]

"I can't support anyone's right to falsify WHOIS records "

really? lets say you set up a libertarian website. shortly thereafter, some pro-government thugs decide they want to find you and kill you, because big government is the be all and end all.

your recourse?

i cant believe you are truly a libertarian. You seem to be promoting international governmental control over such things as WHOIS records. Sounds like the exact opposite of libertarianism.

im not saying i have the 'right to lie', but as i run an international political website, i'd classify it as more as a 'right to speak without getting dead'

CRISP/IRIS helps, but only some

[sff0ghead]

The IETF's CRISP working group has developed a replacement for whois: IRIS (Internet Registry Information Service). IRIS allows for different levels of access, so that you don't have whois's "all or nothing" response any more. This will help protect record details like addresses from harvest by J. Random Abuser (spammer, what have you). This is goodness.

I assume that the law enforcement agencies in the country in which the registry is domiciled would have to provide the highest level of access (equivalent to the current whois), but that other LEAs would have to go through the country of domicile.
This is speculation, though; ICANN/registry/registrar policies may make it easier or harder.

Re:The House of Representatives are Hypocrits

[Peyna]

Learn how Congress works before you try to criticize its processes.

Votes can be taken any number of different ways in the House:

1. Voice vote
2. Divison
3. Recorded

A voice vote is almost always used in the first place, if it's overwhelming, there's no point in wasting time going any further.

Any member can then demand a division, where by those in favor rise, those opposed rise, and are counted, but their votes are not recorded (but the press and others will always note who voted which way).

Then, any member can request a recorded vote, which must be supported by at least 1/5th of a quorum (the rules are slightly modified for any votes by the Committee of the Whole), and then votes are taken by electronic device and officially recorded as to who voted which way.

You can be assured that for almost everything other than entirely non-controversial legislature. Also, most bills regarding income tax increases, and other fiscal measures automatically require a recorded vote.

Identifying yourself to Police

[billstewart]

If you're engaged in an activity which the State has gotten away with demanding that you have a license for, e.g. driving, police may be able to demand that you show them license paperwork. Otherwise, you don't have to tell them anything. They can use information you give them voluntarily, and the whole Miranda process is designed to make sure that police cannot force you to disclose information when you're in a non-voluntary situation, or at least can't use that information against you in court. As an American resident, you're presumed to know this, so anything the police tell you in a non-custody situation is presumed to be voluntary. Cases like Brown vs. Texas hold that you don't even have to identify yourself to police if you're arrested - they can book you as "John Doe" if you don't give them a better name.

The one time I've had my Miranda rights read to me, the cops violated them and the Federal Privacy Act after we got back to the cop shop, or as the sergeant said "This isn't a threat, it's just a choice you can make". (I'd been photographing misbehaving small-town cops, and they didn't appreciate it, but this was pre- Rodney King, so it was easier for them to get away with things, and I was supposed to go on vacation the next day and didn't want to spend the weekend in jail instead of getting on my plane, which the cops were quite correct that they could do.) Charges were later dropped, but it was annoying.

Until the recent Hiibel case , the courts were really clear about this; it's an ugly mess, and the Supremes upheld an Nevada law permitting cops to ask people to identify themselves, in spite of the fact that that's not what the cop did in the events under consideration.

Re:You Misunderstand what Whois Records Are

[gmack]

Actually ICANN has asked registars to crack down on false whois info. Several registars will disable your nameservers if they discover the whois info is false..

One of my customers has already been burned because the address format in his country doesn't look real to someone used to western style addresses. A single complaint to the registar got the domain disabled with no warning whatsoever even though the email address was real.

Re:Enforcement?

[legirons]

"How are they going to enforce it when a large portion of those registrants are actually non-US?"

In the UK at least, ICANN policy overrides national laws (yes I got a letter from the Information Commissioner basically admitting this)